Nothing to see対象期間内には、時間的なクラスターはどこにも見つからなかった。ランサムウェアに関するソース間の重複の大半は、ransomlookとransomware.liveが同じリーク投稿を二度掲載したものであり、グラフ上でどれほど満足のいく見え方をしても、独立した裏付けではない。OTXの「UNC actors」という主張には、確認できる帰属情報がない。「x:」エンティティの多くは「actor:」エンティティの重複であり、二重に数えるべきではない。
A public proof of concept or in-the-wild exploitation report appears for the Magento BlockStrap flaw CVE-2026-103849.
Called Sun 18 Oct · due Wed 28 Oct
No PoC or exploitation report for CVE-2026-103849 (Magento BlockStrap flaw) appears in today's feeds; the KEV addition is for CVE-2026-48356, a different Adobe Commerce CVE, and the due date of 28 October has now passed
Tailscale publishes a fix or advisory for the Tailscale SSH port-forwarding privilege-escalation flaws by 2 November 2026.
Called Mon 26 Oct · due Mon 2 Nov
Tailscale published an advisory warning of SSH privilege-escalation flaws and announced patches are being rushed, but fixes not yet released as of today's feeds; deadline is 2 November
Fresh PHP2Shell indicators — exploitation source addresses or shell artefacts beyond the two IPs seen on 24 October — will appear in news or OTX reporting.
Called Tue 27 Oct · due Fri 6 Nov
OTX and SecurityWeek reporting on 2026-10-27 describe exploitation from two IPs on 24 October and broader UNC actor exploitation, with additional IOC details published beyond the original two addresses
UpTransportation — 2.1× its own prior share (70 claims, 33 expected)
UpEducation — 2.0× its own prior share (52 claims, 26 expected)
UpEnergy & Utilities — 1.5× its own prior share (38 claims, 25 expected)
UpHealthcare — 1.4× its own prior share (116 claims, 81 expected)
22% of claims carry no sector label.
Brand churn
Of the 229 leak-site brands first seen since 2021-09-30, 76% were still claiming 30 days after their first post and 70% were still claiming 60 days after their first post and 68% were still claiming 90 days after their first post and 61% were still claiming 120 days after their first post (Kaplan-Meier; quiet = 60 days without a claim). 19% of the 210 old enough to judge posted on one day and never again; 39% made at least half their claims in their first week. New brands this month: 9 — newest: Whitearmor (2026-10-23, 11 claims), Mimori (2026-10-20, 2 claims), THE SEVEN DEADLY SINS (2026-10-16, 8 claims).
Brands born before coverage began are excluded (their true age is unknown); a rebrand counts as one brand going quiet and another being born.
Targeting
Over the last 180 days, among brands with at least 20 labelled claims: safepay put 35% of its claims on Germany (6.8× every other brand's share); N0n put 34% of its claims on Transportation (7.7× every other brand's share); Storm put 78% of its claims on the United States (2.1× every other brand's share). Widest spread: nightspire across 10.4 effective sectors.
Lift = the brand's share of a sector or country over every other brand's share in the same window; exact binomial tails, Bonferroni-adjusted for the categories tested. Claims with no sector or an Unknown/Other label are excluded.
Posting clock
Over the last 180 days, among brands with at least 30 claims: clop released 92% of its claims on Wednesdays, half of them in 12:00–15:59 UTC; safepay released 63% of its claims on Mondays, half of them in 19:00–19:59 UTC; akira posted only 1 of 193 claims at weekends and half its claims in 12:00–13:59 UTC; half of play's claims appeared in 18:00–20:59 UTC. Leak sites overall are 37% quieter per weekend day than per weekday.
all brands by hour of day, 00–23 UTC; half of all claims land in 12:00–19:59 UTC.
Times are when trackers first saw each claim on the leak site, in UTC: not the attack time, not the operator's clock, and a site that is only reachable at certain hours shows the same pattern; batch releases show as spikes. Hour-of-day concentration: Rayleigh test; weekday shares: exact binomial against every other brand, Bonferroni-adjusted.
Leak-site claims as discovered by trackers, not confirmed breaches. Surprise compares the last 7 days with the group's own prior 173 days (Poisson). Victim claims: ransomware.live and leak-site trackers